Attack Graph Research Articles

An Approach for Internal Network Security Metric Based on Attack Probability

A network security metric may provide quantifiable evidence to assist security practitioners in securing computer networks. However, research on security metrics based on attack graph is not applicable to the characteristics of internal attack; therefore we propose an internal network security metric method based on attack probability. Our approach has the following benefits: it provides the method of attack graph simplification with monitoring event node which could solve the attack graph exponential growth with the network size, while undermining the disguise of internal attacks and improving the efficiency of the entire method; the method of attack probability calculation based on simplified attack graph can simplify the complexity of internal attacks and improve the accuracy of the approach.

A Vulnerability Assessment Method in Industrial Internet of Things Based on Attack Graph and Maximum Flow

To solve the low attack path quantification degree and complex path finding in the industrial Internet of Things, a vulnerability assessment method based on attack graph and maximum flow is proposed. The method takes into account the factors influencing the attack behavior and relationship between network nodes. The attack risk is calculated by common vulnerability scoring system, which increases the attack path quantification degree. The maximum loss flow describes the attack path, evaluates the network vulnerability by maximum loss flow and loss saturation and represents the vulnerability relevance. Avoiding the repeat calculation and obtaining the potential key vulnerability path fast, the augmented road algorithm is used to find optimal attack path within global path. The result shows that the method is feasible and can evaluate the vulnerability and risk path objectively.

Realtime intrusion risk assessment model based on attack and service dependency graphs

Network services are becoming larger and increasingly complex to manage. It is extremely critical to maintain the users QoS, the response time of applications, and critical services in high demand. On the other hand, we see impressive changes in the ways in which attackers gain access to systems and infect services. When an attack is detected, an Intrusion Response System (IRS) is responsible to accurately assess the value of the loss incurred by a compromised resource and apply the proper responses to mitigate attack. Without having a proper risk assessment, our automated IRS will reduce network performance, wrongly disconnect users from the network, or result in high costs for administrators reestablishing services, and become a DoS attack for our network, which will eventually have to be disabled. In this paper, we address these challenges and we propose a new model to combine the Attack Graph and Service Dependency Graph approaches to calculate the impact of an attack more accurately compared to other existing solutions. To show the effectiveness of our model, a sophisticated multi-step attack was designed to compromise a web server, as well as to acquire root privilege. Our results illustrate the efficiency of the proposed model and confirm the feasibility of the approach in real-time.

Non-Homogeneous Stochastic Model for Cyber Security Predictions

Any computer system with known vulnerabilities can be presented using attack graphs. An attacker generally has a mission to reach a goal state that he expects to achieve. Expected Path Length (EPL) [1] in the context of an attack graph describes the length or number of steps that the attacker has to take in achieving the goal state. However, EPL varies and it is based on the “state of vulnerabilities” [2] [3] in a given computer system. Any vulnerability throughout its life cycle passes through several stages that we identify as “states of the vulnerability life cycle” [2] [3]. In our previous studies we have developed mathematical models using Markovian theory to estimate the probability of a given vulnerability being in a particular state of its life cycle. There, we have considered a typical model of a computer network system with two computers subject to three vulnerabilities, and developed a method driven by an algorithm to estimate the EPL of this network system as a function of time. This approach is important because it allows us to monitor a computer system during the process of being exploited. Proposed non-homogeneous model in this study estimates the behavior of the EPL as a function of time and therefore act as an index of the risk associated with the network system getting exploited.

Simulation of Attack Signal Path Identification in Radio Network Information

It is possible to improve the safety performance of the radio network by accurately identifying the attack signal path in the radio network information. When the attack signal path identification is carried out, it is necessary to calculate the vulnerability of the attack signal path, obtain the time series sample set of the net-work attack path, train the sample set for different vulnerabilities, and complete the path recognition.The traditional method is to establish the attack graph model. It cannot calculate the vulnerability of the attack signal path and cannot carry out the training, which leads to the limitation of the path recognition and the low efficiency. An improved identification method of attack signal path in radio network information with improved attack graph is proposed. Firstly, the attack map of the traditional method is transformed according to the theory of graph theory, and the concept of vulnerability factor is introduced into the improved attack graph. The vulnerability of the attack route is improved, and then the sliding time window is used to construct the network attack path recognition Time series sample set, Ada-Boosting method is used to train the sample sets with different vulnerabilities,and the regression matrix is obtained by using the training results. Finally, the attack signal path identification in the radio network information is completed.The simulation results show that the improved method has high accuracy and can guarantee the smooth operation ofthe radio network.

An Evolutionary Approach of Attack Graph to Attack Tree Conversion

An Evolutionary Approach of Attack Graph to Attack Tree Conversion

Risk Assessment in a Sensor Cloud Framework Using Attack Graphs

A sensor cloud consists of various heterogeneous wireless sensor networks (WSNs). These WSNs may have different owners and run a wide variety of user applications on demand in a wireless communication medium. Hence, they are susceptible to various security attacks. Thus, a need exists to formulate effective and efficient security measures that safeguard these applications impacted from attack in the sensor cloud. However, analyzing the impact of different attacks and their cause-consequence relationship is a prerequisite before security measures can be either developed or deployed. In this paper, we propose a risk assessment framework for WSNs in a sensor cloud that utilizes attack graphs. We use Bayesian networks to not only assess but also to analyze attacks on WSNs. The risk assessment framework will first review the impact of attacks on a WSN and estimate reasonable time frames that predict the degradation of WSN security parameters like confidentiality, integrity and availability. Using our proposed risk assessment framework allows the security administrator to better understand the threats present and take necessary actions against them. The framework is validated by comparing the assessment results with that of the results obtained from different simulated attack scenarios.

Network Security Risk Assessment System Based on Attack Graph and Markov Chain

Network security risk assessment technology can be found in advance of the network problems and related vulnerabilities, it has become an important means to solve the problem of network security. Based on attack graph and Markov chain, this paper provides a Network Security Risk Assessment Model (NSRAM). Based on the network infiltration tests, NSRAM generates the attack graph by the breadth traversal algorithm. Combines with the international standard CVSS, the attack probability of atomic nodes are counted, and then the attack transition probabilities of ones are calculated by Markov chain. NSRAM selects the optimal attack path after comprehensive measurement to assessment network security risk. The simulation results show that NSRAM can reflect the actual situation of network security objectively.

Cyber-attack path discovery in a dynamic supply chain maritime risk management system

Maritime port infrastructures rely on the use of information systems for collaboration, while a vital part of collaborating is to provide protection to these systems. Attack graph analysis and risk assessment provide information that can be used to protect the assets of a network from cyber-attacks. Furthermore, attack graphs provide functionality that can be used to identify vulnerabilities in a network and how these can be exploited by potential attackers. Existing attack graph generation methods are inadequate in satisfying certain requirements necessary in a dynamic supply chain risk management environment, since they do not consider variables that assist in exploring specific network parts that satisfy certain criteria, such as the entry and target points, the propagation length and the location and capability of the potential attacker. In this paper, we present a cyber-attack path discovery method that is used as a component of a maritime risk management system. The method uses constraints and Depth-first search to effectively generate attack graphs that the administrator is interested in. To support our method and to show its effectiveness we have evaluated it using real data from a maritime supply chain.

Power System Reliability Assessment Incorporating Cyber Attacks Against Wind Farm Energy Management Systems

By exploiting the vulnerabilities in cyber components, an attacker could intrude in the wind farm supervisory control and data acquisition (SCADA) system and energy management system (EMS), and maliciously trip one or multiple wind turbines. The reliability of the overall power system could thus be impacted by the performance of wind farms. In this paper, cyber attack scenarios concerning cyber components or networks are considered in the integrated wind farm SCADA/EMS system architecture. Two Bayesian attack graph models are adopted to represent the procedures of successful cyber attacks, and a mean time-to-compromise model is used by considering different attack levels and various vulnerabilities. Frequencies of successful cyber attacks on the wind farm SCADA/EMS system are estimated. A procedure for evaluating the power system reliability is proposed by considering wind turbine trips caused by various cyber attacks. Simulations are conducted based on a typical IEEE reliability test system. Simulation results indicate that the overall system reliability decreases when the frequency of successful attacks on the wind farm SCADA/EMS system and skill levels of attackers increase.

An Enhanced Attack Graph Model Based Technique to Mitigate Zombie Attack in Cloud Computing using Fuzzy Logic

A cloud storagea secure cloud of solid cloud data is a solid well-defined framework. This is the confidence of the cloud an essential undertaking for cloud specialist organizations. In this proposed research a technique is developed for security in cloud users. An improvement in the existing technique that is called Role Based Access Model is done by including the command and browser analysis. Using these included features the activities of any unauthorized or authorized person is recorded that is to be analyzed later on to find out the intruder in network of cloud. This implementation aims towards the establishment of performance qualitative analysis on load sharing in VM to VM and then implemented in Clouds with Java language. In this thesis the study of load balancing algorithm with heterogeneous resources of the cloud, followed by comparative survey of other algorithms in cloud computing with respect to scalability, homogeneity or heterogeneity and process migration. Cloudlet long length versus Host bandwidth a pattern is observed in which response time increases in proportionate manner. Using the modified approach the reduction in the down time of the various processes is achieved as shown in results.

Cyber threat assessment via attack scenario simulation using an integrated adversary and network modeling approach

Existing research on cyber threat assessment focuses on analyzing the network vulnerabilities and producing possible attack graphs. Cyber attacks in real-world enterprise networks, however, vary significantly due to not only network and system configurations, but also the attacker’s strategies. This work proposes a cyber-based attacker behavior model (ABM) in conjunction with the Cyber Attack Scenario and Network Defense Simulator to model the interaction between the network and the attackers. The ABM leverages a knowledge-based design and factors in the capability, opportunity, intent, preference, and Cyber Attack Kill Chain integration to model various types of attackers. By varying the types of attackers and the network configurations, and simulating their interactions, we present a method to measure the overall network security against cyber attackers under different scenarios. Simulation results based on four attacker types on two network configurations are shown to demonstrate how different attacker behaviors may lead to different ways to penetrate a network, and how a single misconfiguration may impact network security.

Efficient Attack Graph Analysis through Approximate Inference

Attack graphs provide compact representations of the attack paths an attacker can follow to compromise network resources from the analysis of network vulnerabilities and topology. These representations are a powerful tool for security risk assessment. Bayesian inference on attack graphs enables the estimation of the risk of compromise to the system’s components given their vulnerabilities and interconnections and accounts for multi-step attacks spreading through the system. While static analysis considers the risk posture at rest, dynamic analysis also accounts for evidence of compromise, for example, from Security Information and Event Management software or forensic investigation. However, in this context, exact Bayesian inference techniques do not scale well. In this article, we show how Loopy Belief Propagation—an approximate inference technique—can be applied to attack graphs and that it scales linearly in the number of nodes for both static and dynamic analysis, making such analyses viable for larger networks. We experiment with different topologies and network clustering on synthetic Bayesian attack graphs with thousands of nodes to show that the algorithm’s accuracy is acceptable and that it converges to a stable solution. We compare sequential and parallel versions of Loopy Belief Propagation with exact inference techniques for both static and dynamic analysis, showing the advantages and gains of approximate inference techniques when scaling to larger attack graphs.

Selection of countermeasures against network attacks based on dynamical calculation of security metrics

This paper considers the issue of countermeasure selection for ongoing computer network attacks. We outline several challenges that should be overcome for the efficient response: the uncertainty of an attacker behavior, the complexity of interconnections between the resources of the modern distributed systems, the huge set of security data, time limitations, and balancing between countermeasure costs and attack losses. Although there are many works that are focused on the particular challenges, we suppose that there is still a need for an integrated solution that takes into account all of these issues. We suggest a model-driven approach to the security assessment and countermeasure selection in the computer networks that takes into account characteristics of different objects of assessment. The approach is based on integration with security information and event management systems to consider the dynamics of attack development, taking into account security event processing. Open standards and databases are used to automate security data processing. The suggested technique for countermeasure selection is based on the countermeasure model that was defined on the basis of open standards, the family of interrelated security metrics, and the security analysis technique based on attack graphs and service dependencies. We describe the prototype of the developed system and validate it on several case studies.

An Augmented 0-day Attack Graph Generation Method

Attack graph is an important tool for analyzing network attack. However, the traditional attack graph does not take 0-day vulnerability into account. It is difficult to analyze the attack path with 0-day vulanrability based on traditional attack graph. In this work, we modelled the 0-day vulnerability and its exploiting rules, and bulit an augmented 0-day attack garph, which enables us to analyze the attack path with 0-day vulnerability. The experiment indicated that we could get the attack path with 0-day vulnerability.

The 5th International Conference on Science & Engineering in Mathematics, Chemistry and Physics 2017 (ScieTech 2017), The Ramada Bintang Hotel, Kuta, Bali, Indonesia 21 - 22 January 2017

The 5th International Conference on Science & Engineering in Mathematics, Chemistry and Physics 2017 (ScieTech 2017), The Ramada Bintang Hotel, Kuta, Bali, Indonesia 21 - 22 January 2017

Network security assessment using a semantic reasoning and graph based approach

Owing to the high value of business data, sophisticated cyber-attacks targeting enterprise networks have become more prominent, with attackers trying to penetrate deeper into and reach wider from the compromised machines. An important security requirement is that domain experts and network administrators have a common vocabulary to share security knowledge and quickly help each other respond to new threats. We propose an innovative ontology and graph-based approach for security assessment. An ontology is designed to represent security knowledge such as that of assets, vulnerabilities, and attacks in a common form. Using the inference abilities of the ontological model, an efficient system framework is proposed to generate attack graphs and assess network security. The performance of the proposed system is evaluated on test networks of differing sizes and topologies.

Analysis of Vulnerability Risk Using Game Model and Risk Matrix

For the quantitative analysis of vulnerability risk in the information system, the paper proposes the non-cooperative and nonzero-sum game model of vulnerability attack-defense, in which the value of vulnerability is evaluated by expected payoffs on the equilibrium. In the paper, with the two operators proposed, the comprehensive connection of the vulnerabilities is calculated through the quantitative analysis of the vulnerabilities connection using attack graph and risk matrix. Then the assessment method of system vulnerability risk is devised through the above vulnerability value and comprehensive connection. Based on the quantitative analysis of the vulnerabilities’ own risk and transmission risk, the proposed method comprehensively assesses the global risk of vulnerabilities, whose result can be used to recognize the key vulnerability and improve the effectiveness of system security defense. Finally the model and method proposed in this paper are proved to be valid through an example.

Searching Forward Complete Attack Graph Generation Algorithm Based on Hypergraph Partitioning

Attack graph is an effective method for network vulnerability analysis, existing methods of attack graph can’t meet the requirements of the dynamical analysis of the large-scale complex network. In this paper, we proposed a searching forward complete attack graph generation algorithm based on hypergraph partitioning. First, ensure the load balancing of each of the computing agents by hypergraph partitioning; second, summarize various new attack templates; third, propose vulnerabilities exploited assumption, improve the efficiency of attack graph generation, reduce the recomputed work of attack graph generation dynamically; last, propose a new idea that generating the attack graph from the vulnerabilities to attacker reversely, ensure the integrity of vulnerabilities analysis, reduce the additional store memory and computing resources

Modeling Attack Process of Advanced Persistent Threat Using Network Evolution

Advanced Persistent Threat (APT) is one of the most serious network attacks that occurred in cyberspace due to sophisticated techniques and deep concealment. Modeling APT attack process can facilitate APT analysis, detection, and prediction. However, current techniques focus on modeling known attacks, which neither reflect APT attack dynamically nor take human factors into considerations. In order to overcome this limitation, we propose a Targeted Complex Attack Network (TCAN) model for APT attack process based on dynamic attack graph and network evolution. Compared with current models, our model addresses human factors by conducting a two-layer network structure. Meanwhile, we present a stochastic model based on states change in the target network to specify nodes involved in the procedure of this APT. Besides, our model adopts time domain to expand the traditional attack graph into dynamic attack network. Our model is featured by flexibility, which is proven through changing the related parameters. In addition, we propose dynamic evolution rules based on complex network theory and characteristics of the actual attack scenarios. Finally, we elaborate a procedure to add nodes by a matrix operation. The simulation results show that our model can model the process of attack effectively.